- syslog-ng - lists.balabit.hu

buffer limitations and TCP compression
by Jason Haar 20 Mar '03

20 Mar '03

Hi there Can someone explain to me how the tcp/udp destination options handle network outages/congestion? If I set my fifo to 10000, does that mean if the remote server is down (I assume this only affects TCP - not UDP BTW), the "client" will hold up to 10000 records before dropping... the oldest? Just what does happen then? Also, does anyone think adding a compress option to the tcp destination option is a good idea? It could really cut down on the traffic (esp if you could force a *minimum* fifo queue size - to increase your chance of repeated data). It could make centralized logging over WANs much more attractive. Thanks Jason

3 5

2 questions: confusion + compile problem
by Brian C. Hill 20 Mar '03

20 Mar '03

Hello, Let me try this again. :) Is the stable release 1.6 or 1.9? I see a 1.9.1 and 1.6.0rc1. The older one seems to be a release candidate and the newer one seems to be full release. Am I missing something? Also, is olib needed for 1.9.1? The configure script didn't complain when it couldn't find it, but I did get a make error that getopt.h couldn't be found. I tried building against glib 2.2.1, which built and installed successfully. Thanks for any clues... Brian

2 1

2 questions: confusion + compile problem
by Brian C. Hill 20 Mar '03

20 Mar '03

Hello, Is the stable release 1.6 or 1.9? I see a 1.9.1, but a 1.6.0rc1. Should I go with the older release candidate the... 1.9.1 that doesn't seem to be a release candidate? Also, it olib needed for 1.9.1? The configure script didn't complain when it couldn't find it, but I did get an error that getopt.h couldn't be found. I tried building against glib 2.2.1, which built and installed successfully. Thanks for any clues... Brian

1 0

syslog-ng in a Solaris environment
by George Horvath 19 Mar '03

19 Mar '03

Hi All, I am working on a log centralization project in a Solaris environment and my initial search led me to syslog-ng. I signed up to this mailing list to get a feel for syslog-ng's performance and support issues. It seems like a good product which is recommended by a lot of people. I am wondering though if there are any other products that may be better, have better support etc.. I'm willing to pay for a commercial product with advantages over syslog-ng. Although I'm a huge fan of open source, I use a lot of os products how ever I am not a programmer so support is an issue for me. If you are running syslog-ng in a Solaris environment (especially Solaris 8/9) I would very much be interested hearing about your experiences. I would really be interested in positive comments from someone who is successfully employing syslog-ng. There were a few Solaris based questions recently but that's not a good indication of it being a problematic platform. Finally, I noticed there are frequent releases of syslog-ng. How easy/difficult/time consuming is it to upgrade an operational environment? TIA, George Horvath P.S. I am a Hungarian born, so it would be interesting for me to use syslog-ng

3 3

how stop syslog-ng from adding src@hostname part to log files?
by seberino＠spawar.navy.mil 19 Mar '03

19 Mar '03

My syslog-ng.conf is very tiny but functional... source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; This makes /var/log/messages start every line with src@hostname where hostname is the name of my machine. How can I stop src@hostname from being printed??? It is messing up log checking programs! Thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

syslog-ng crash
by Chriss 19 Mar '03

19 Mar '03

Hello List, my syslog-ng "loghost" crash every 1-5 minute, so I did the update to 1.6.0rc1, but the problem still exist. The service died with a "Segmentation fault". A run in debug mode and/ore strace report: ----->8------schnipp-----8<----------------------------------- time(NULL) = 1047983908 time(NULL) = 1047983908 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ ----->8------schnapp-----8<----------------------------------- after the last logging entry. The os is a debian unstable on a Siemens Nixdorf 2x333Mhz server. Anybody with an idea? Bye Bye, Chriss mailto:syslog-ng@kordesee.de ---- Turn your Pentium into a Gameboy: Type WIN at C:\>

3 7

syslog-ng 1.4.17 / cron messages / RH 7.3
by Tim Sheets 19 Mar '03

19 Mar '03

Hello group, I have just installed syslog-ng 1.4.17 and playing with it on RH 7.3 Initially I was getting crond messages in my logs (was attempting to send them to a separate cron log file, but they were ending up in both /var/log/cron as well as the standard /var/log/messages files. I tried to change the filter (I hadn't matched the case, etc...) thinking that may help. The messages stopped going to both places. I have tried various things like changing it back, re-organizing the filter/log statements (grasping at straws), and added a log entry for filter(DEFAULT), but I still can't seem to get them to come back. Here is my conf file: options { sync(0); chain_hostnames(no); dir_perm(0755); perm(0644); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use__dns(yes); use_fqdn(yes); create_dirs(yes); keep_hostname(yes); }; source s_sys { unix-stream("/dev/log"); internal(); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_hosts { file("/var/syslog/hosts/$YEAR/$MONTH/$HOST" owner(root) group(root) perm(0644) dir_perm(0700) create_dirs(yes)); }; destination d_mlal { usertty("*"); }; destination d_cron { file("/var/log/cron"); }; filter f_auth { facility(authpriv); }; filter f_cron { facility(CROND) or facility(cron); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_spooler { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_hosts { facility(local3) or facility(local4); }; # filter f_mesg { level(info) or facility(mail) or facility(authpriv) or facility(user) and not facility(cron); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_spooler); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_hosts); destination(d_hosts); }; # log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; Here is a sample of the /var/log/cron file that has a couple of the messages that aren't showing up: Mar 6 15:10:00 chumly CROND[6213]: (root) CMD (/home/mrtg/run-rrd-cfgs) Mar 6 15:15:00 chumly CROND[6232]: (root) CMD (/home/mrtg/run-rrd-cfgs) I have implemented the init.d file that is included in the contrib directory, and between config file changes, used service syslog-ng restart to kick it into re-reading the new conf file. Any ideas what I am doing wrong, or where to start looking? I am relatively new to the whole linux world, but trying very hard to get a handle on things. :-) Any help is appreciated. Tim _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

TCP reconnections randomly failing
by Xavier de Labouret 19 Mar '03

19 Mar '03

Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret

2 1

Syslog-NG on Mac OSX?
by Blaise St-Laurent 19 Mar '03

19 Mar '03

So i picked up a powerbook recently, and i was looking around in the init files, and noticed it's using the syslogd from the BSD system (which of course, is what i expected). I've been thinking of moving it over to syslog-ng but i noticed something quite strange... syslogd's startup script first deletes the /dev/log entry, and then starts up the daemon, which to me means that the syslogd daemon creates the dev entry itself. Am I correct in assuming this? If i want to install syslog-ng onto my mac, how do i emulate this functionality? has anyone done this yet? Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

File Permissions Not Being Set
by Collin Lichtenberger 19 Mar '03

19 Mar '03

Could anyone be able to give me an idea of what is going on with my system. I am running Redhat 8.0 with syslog-ng 1.4.17. I use it to watch network devices. The devices log to syslog-ng running on my RH8 box. Syslog-ng runs and creates log files like it should except the permission on the files are always the default 600. Even though my config file looks like this: /etc/syslog-ng/syslog-ng.conf - ... destination d_snmptrapd { file("/var/log/snmptrapd" perm(0644) ); }; destination d_radiusd { file("/var/log/radiusd"); }; destination d_nethost { file("/var/log/net/$HOST/$YEAR$MONTH$DAY" owner(apache) group(apache) perm(0644) dir_perm(0755)create_dirs(yes) ); }; destination d_nethost_clump { file("/var/log/net/netdevice" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes) ); # Special ... log { source(s_src); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_src); filter(f_radiusd); destination(d_radiusd); }; log { source(s_src); filter(f_all); destination(d_all); }; # # Network Logging # log { source(s_net); destination(d_nethost); }; log { source(s_net); destination(d_nethost_clump); };}; - Even though I have the permissions set as something else it still creates files with 600 permission instead of 644 like it's instructed. (This is for any file it creates.) Though syslog-ng will create the file in the correct directories. I am thoroughly confused and would appreciate any help. Thank You. Thanks, COLLIN

2 1

Syslog-NG & MySQL.....
by Matthias Krawutschke 19 Mar '03

19 Mar '03

Sander, i have read your email, that you are running an SYSLOG - Server on Solaris 8 with MySQL. Can you tell me please, how does it works or can you send me your files? I must create these environment too here in my office. Kind regards and thank you for advance ..... Matthias Krawutschke

1 0

help
by toohs 19 Mar '03

19 Mar '03

Please unsubscribe me. thank you. regards, han soon

1 0

RE: [syslog-ng]TCP reconnections randomly failing
by Hamilton, Andrew 18 Mar '03

18 Mar '03

You should at the very least move to the most recent 1.5.* line. The 1.6.* line though still a release candidate is very stable and I would recommend it. There are some bugs in the 1.4.* line that were corrected in later releases. Regards, Drew -----Original Message----- From: Xavier de Labouret [mailto:Xavier.de_Labouret@cvf.fr] Sent: Tuesday, March 18, 2003 5:50 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]TCP reconnections randomly failing Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

TCP reconnections randomly failing
by Xavier de Labouret 18 Mar '03

18 Mar '03

Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret

1 0

syslog-ng dies on reload
by Florian Heissenhuber 17 Mar '03

17 Mar '03

Hi, I'm using syslog-ng on our central syslog server and it works really great. However I've found the following problem as I added a new filter rule: I've added a filter rule that filters specific error messages and sends these error messages to a shell script that generates a SNMP traps. The relavant configuration lines look as follows: destination snmpsend { program("/data/scripts/pix_snmp_send.ksh "); }; filter f_SNMPTRAP1 { match('PIX-1-10100[1-5]|PIX-1-102001'); }; log { source(net); filter(f_SNMPTRAP1); destination(snmpsend); }; If I send a reload signal to syslog-ng (kill -HUP) the first time, everything is OK. Syslog-ng reloads its configuration and the following messages is found in /var/log/messages: Mar 17 11:15:47 pixsysl01 syslog-ng[11020]: new configuration initialized Mar 17 11:15:46 pixsysl01 syslog-ng[11020]: SIGHUP received, restarting syslog-ng If I send a reload signal to syslog-ng (kill -HUP) the next time, syslog-ng dies with the following message: Mar 17 11:17:36 pixsysl01 syslog-ng[11020]: new configuration initialized Mar 17 11:17:35 pixsysl01 syslog-ng[11020]: SIGHUP received, restarting syslog-ng Mar 17 11:17:36 pixsysl01 syslog-ng[11020]: syslog-ng version 1.5.26 going down Since I'm using logrotate for automatic log rotation, syslog-ng is reloaded more than once a day (and dies with the second reload). Any idea what's wrong? I've already tried version 1.6rc1, but it has the same effect! Regards, Florian -- Florian Heissenhuber

1 0

Destination driver and variables
by Casimir Leonard 16 Mar '03

16 Mar '03

Hello, For begining, for me syslog-ng is the best syslog dameon. I have a question about a option for the destination driver. It's possible to have the variable HOST (equal at the dns name) but i would like to know if it's possible to have in 2 different variables the dns name and the IP address of the transmitter. (ex : HOST=www.balabit.com and IP=212.92.18.33) Thank's in advance for the response. Bye Damien FONTAINE - France --------------------------------- Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Testez le nouveau Yahoo! Mail

1 0

How to disable logging to the console?
by Alexander von Hedenstroem 16 Mar '03

16 Mar '03

Hello! I am using syslog-ng 1.5.15 for a couple of days now on my Debian (woody/stable) system, but have some problems configuring it properly. I switched to syslog-ng because I've read that it is able to filter messages. I'd like to use it to filter the iptables stuff away from my console. Fortunately, I'm not the first with this problem, so I found some help in the archives and in newsgroups, leading me to the following setup: First, I modified the standard source for reading kernel messages (I tried this with file instead of pipe, too -- which one is preferred?): source src { unix-dgram("/dev/log"); pipe("/proc/kmsg"); internal(); }; Then I added some filters and destinations; f_netfilter recognizes iptables stuff by a custom log-prefix, while netfilter2 looks for common strings a message (i tried this because there are some log messages from iptables which seem not to be produced by my iptables script, however...): destination netfilter { file("/var/log/netfilter.log" owner("root") group("adm") perm(0640)); }; filter f_netfilter { match("netfilter: "); }; filter f_netfilter2 { match(".* (IN|OUT|SRC|DST|LEN|MAC|PROTO|WINDOW|TTL|TOS)=.*"); }; filter f_apic { match("APIC error on CPU"); }; Finally, I added some log paths: log { source(src); filter(f_netfilter); destination(netfilter); flags(final); }; log { source(src); filter(f_netfilter2); destination(netfilter); flags(final); }; log { source(src); filter(f_apic); destination(kern); flags(final); }; (My syslog-ng.conf lists first the sources, then destinations, filters, and finally logs. It's not mixed. I understood it this way that the order is only important for log statements. I hope this is correct.) After a reboot (I had problems with restarting it), there are messages directed to the netfilter log, and the messages log is kept clean too, but my console is still flooded! I commented out ALL the log paths of syslog-ng.conf and rebootet which results in empty log files but still console logging. Then I tried klogd -c 0 (which should stop klogd from logging to the console if it is not extremely important) as well as stopping klogd completely which has no visible effect either. So here's my question: Where are those console messages from? Is it possible to log them through syslog-ng and finally stop logging to the console? I really tried to help myself, so please excuse if this question was asked earlier -- I didn't found it! Thanks for your help!!! Alexander von Hedenstroem.

4 4

Re: syslog-ng
by garvald＠bluemail.ch 13 Mar '03

13 Mar '03

> >You might have noticed that I still had trouble believing that the >packets are making it to the loghost, despite your 'netstat -a'. Just >run 'netstat -t' on linux to see the TCP connections and see if you see >the other box actually connected. Try the telnet test that I mentioned >in the earlier post. Cover the lower layers of the stack before you >concentrate on the app layer. That was exactly my problem, there were no packages going anywhere, neither locally or remote. However if syslog-ng is runnin smoothly on the linux side of things, I assume tcp-wrappers has been installed and configured correctly. If the hosts.allow entry is correct then there's no reason it shouldnt accept the logs Anyway, I have now solved the problem. I tried installing 1.6.0rc1 (on solaris) however it wouldnt accept the fact that libol-0.3.9 really was that version. So I tried 1.5.26 and it runs smoothly, which 1.5.25 never did. next thing was on the linux side, I had to downgrade from a _very_ buggy 1.6.0_rc1-r1 syslog-ng gentoo release to (a still unstable) 1.5.26-r1. Now things seems to be working the way they should...logging locally and remotely seems to be working. Syslog-ng = a very touchy, senstive, but capable logger (once its runnin) cheers -AlanCB

2 1

Spec files...
by Blaise St-Laurent 13 Mar '03

13 Mar '03

I've been talking to Robert, and we were wondering if the spec file and associated files he created could be in the main distribution of syslog-ng. If there's any work that needs to be done (such as creating a patch file for it all) please let me know, and i'll get it done. BTW Any news on a new rc of syslog-ng?

2 1

syslog-ng 1.4.17 on Solaris 8
by enelson＠FLEETCC.COM 13 Mar '03

13 Mar '03

Hi all, I am having a problem with syslog-ng 1.4.17 on solaris 8. When I start syslog-ng I get parse errors at my firs "log" statement. Here is a shortened syslog-ng.conf file I'm using. All destination files are created and owned by root. Like I said, it dies at that first log statement (or any log statement) with a "Parse error at line (line number), Parse error reading configuration file, exiting. I have checked this over and over again, I'm just not seeing it. Thanks in advance for any information! Oh, I know I should upgrade to the 1.5.x tree, I am fighting that battle with our software maintainter now, I asked for "latest stable" and got 1.4.17. Eric Nelson enelson(a)fleetcc.com -------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { tcp(); udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; destination console { file("/dev/sysmesg"); }; destination switch { file("/data/logs/switch.log"); }; destination test { file("/data/logs/test.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("var/log/messages"); }; filter f_authpriv { facility(auth); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_switch { facility(local6, local7); }; filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(kern, auth, mail, local6, local7, local4, local0); } log { source(local); filter(f_authpriv); destination(authlog); };

2 1

Macro question
by McNutt, Justin M. 12 Mar '03

12 Mar '03

Hey all, I'm new to the list, and fairly new to syslog-ng, so I hope I'm not asking a VFAQ (although a perusal of the documentation and the mailing list archives suggests that I'm not, so here goes). I have a server (dnps-linux2) that is set up as an SNMP trap receiver (Net-SNMP 5.0.3). Traps are then reformatted and sent to the local host's syslog service (via logger(2), I think). They arrive using facility local0. This part works. The part that sucks is that the IP address of the original trap sender is embedded in the $MSG portion of the entry. Here's an example: Mar 12 15:33:47 dnps-linux2 snmptrapd[797]: 128.206.169.240: Enterprise Specific Trap (blah blah blah) I'm trying to set up a destination that will split these up by sender, but $HOST always returns "dnps-linux2". $PROGRAM will return snmptrapd. I need to do something like this: source s_sys { (all the usual sources) }; filter f_snmptrap { facility(local0) and program(snmptrapd); }; destination d_snmptrap { file("/usr/log/traps/$SENDER/$YEAR.$MONTH.$DAY.traps"); }; log { source(s_sys); filter(f_snmptrap); destination(d_snmptrap); }; In the examples above, $SENDER should resolve to "128.206.169.240", perhaps by somehow matching $MSG against "^(\d+\.\d+\.\d+\.\d+):". Is this possible in any version of syslog-ng? I'm currently running 1.5.25 (on RedHat 7.3), but I don't have any qualms about upgrading if I can get this function (which I assume would go in the filter{} clause?). Any help is appreciated. Thanks! Justin McNutt Network Systems Analyst DNPS, Mizzou Telecom (573) 882-5183 In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds

1 0

RE: [syslog-ng]syslog-ng 1.4.17 on Solaris 8
by Hamilton, Andrew 12 Mar '03

12 Mar '03

You are missing a semicolon on the last filter statement at the end. -----Original Message----- From: enelson(a)FLEETCC.COM [mailto:enelson@FLEETCC.COM] Sent: Wednesday, March 12, 2003 2:54 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.4.17 on Solaris 8 Hi all, I am having a problem with syslog-ng 1.4.17 on solaris 8. When I start syslog-ng I get parse errors at my firs "log" statement. Here is a shortened syslog-ng.conf file I'm using. All destination files are created and owned by root. Like I said, it dies at that first log statement (or any log statement) with a "Parse error at line (line number), Parse error reading configuration file, exiting. I have checked this over and over again, I'm just not seeing it. Thanks in advance for any information! Oh, I know I should upgrade to the 1.5.x tree, I am fighting that battle with our software maintainter now, I asked for "latest stable" and got 1.4.17. Eric Nelson enelson(a)fleetcc.com -------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { tcp(); udp(); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; destination console { file("/dev/sysmesg"); }; destination switch { file("/data/logs/switch.log"); }; destination test { file("/data/logs/test.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("var/log/messages"); }; filter f_authpriv { facility(auth); }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_switch { facility(local6, local7); }; filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(kern, auth, mail, local6, local7, local4, local0); } log { source(local); filter(f_authpriv); destination(authlog); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Who can help a newbie?
by Martijn Koopsen 12 Mar '03

12 Mar '03

All, As a relative newbie in the world syslog-ng i tried a few things. I am able to split all the information that comes into the logging-server into seperate files. Now i would like to change the config in a way that when a specific message comes in it is written to a file but at the same time triggers a shell script that starts running. Who can help me with this? Regards, Martijn Koopsen

2 1

solaris linux
by garvald＠bluemail.ch 12 Mar '03

12 Mar '03

Hi all trying to log from solaris 8 to Linux (gentoo). I'm using 1.5.26 on the linux side and 1.5.25 on the solaris. I've tried several linux versions ranging from 1.4x to current with no luck. Logging from linux -> linux is no problem. I've tried googling and newsgroups etc and writing mails but nobody can help. If nobody replies to this i'll be switching to another logger ;c] here's the configuration I'm using, its very basic and according to an earlier post from the "maintainer" it should work: solaris: source s_all { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; linux: source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/HOSTS/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_all); destination(d_messages); }; ## why is nothing logged from the solaris box ? ##

2 2

Re: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3
by EDL.Essed＠belastingdienst.nl 12 Mar '03

12 Mar '03

To make my own describtion a bit less criptic: In the file configure I changed these 3 lines: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/^$[0-9]\+$\.[0-9]\+\.[0-9] \+$+[0-9]*$\?$/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.$[0-9]\+$\.[0-9] \+$+[0-9]*$\?$/\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.[0-9]\+\.$[0-9]\+$ $+[0-9]*$\?$/\1/'` to these lines: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/$[0-9]*$\.[0-9]*\.[0-9] */\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.$[0-9]*$\.[0-9] */\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9] *$/\1/'` and run configure again. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-G2.36 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | robertmg(a)WellsFargo.C| | | OM | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 12-03-2003 01:05 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: RE: [syslog-ng]Syslog-ng 1.6.0rc1 and AIX 4.3.3 | >-------------------------------------------------------------------------------------------------------------------------------| From: Gehring, Andrew x66132 >I'm trying to compiling 1.60rc1 on AIX 4.3.3 >I've tried both gcc-2.95 and gcc-3.2 both with make-3.80 >Not matter what I've tried it always fails to find libol 0.3.9 which I've >successfully compiled and installed in /usr/local >as a note I successfully compiled 1.5.26 on the same box, and it found libol-0.3.9 >all by itself... :-) <from_archive> > From: EDL.Essed(a)belastingdienst.nl > Sent: Monday, February 24, 2003 2:33 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.6.0rc1 available > > > > Hi, > > I'm having problems building, checking for libol fails. > > ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 > checking libol version >= 0.3.9... no > configure: error: Required libol version not found > > Looking at configure.in, I see the sed part has changed. > Changing it back > to the 3 lines from 1.5.26 makes it work again. <snip> </from_archive> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0